From: Jeremy Allison <jra@samba.org>
Date: Mon, 23 Jan 2017 18:06:44 +0000 (-0800)
Subject: s3: VFS: shadow_copy2: Fix a memory leak in the connectpath function.
X-Git-Tag: samba-4.4.10~38
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=79c2349c2d57068a34356918a8db285515a23812;p=thirdparty%2Fsamba.git

s3: VFS: shadow_copy2: Fix a memory leak in the connectpath function.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12531

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
(backported from commit 4d339a88851f601fae195ac8ff0691cbd3504f41)
---

diff --git a/source3/modules/vfs_shadow_copy2.c b/source3/modules/vfs_shadow_copy2.c
index b096d4e5a9d..aecc4822558 100644
--- a/source3/modules/vfs_shadow_copy2.c
+++ b/source3/modules/vfs_shadow_copy2.c
@@ -52,6 +52,8 @@ struct shadow_copy2_config {
 	char *shadow_cwd; /* Absolute $cwd path. */
 	/* Absolute connectpath - can vary depending on $cwd. */
 	char *shadow_connectpath;
+	/* malloc'ed realpath return. */
+	char *shadow_realpath;
 };
 
 static bool shadow_copy2_find_slashes(TALLOC_CTX *mem_ctx, const char *str,
@@ -2086,6 +2088,13 @@ static const char *shadow_copy2_connectpath(struct vfs_handle_struct *handle,
 		goto done;
 	}
 
+	/*
+	 * SMB_VFS_NEXT_REALPATH returns a malloc'ed string.
+	 * Don't leak memory.
+	 */
+	SAFE_FREE(config->shadow_realpath);
+	config->shadow_realpath = result;
+
 	DBG_DEBUG("connect path is [%s]\n", result);
 
 done:
@@ -2164,6 +2173,12 @@ static int shadow_copy2_get_quota(vfs_handle_struct *handle, const char *path,
 	return ret;
 }
 
+static int shadow_copy2_config_destructor(struct shadow_copy2_config *config)
+{
+	SAFE_FREE(config->shadow_realpath);
+	return 0;
+}
+
 static int shadow_copy2_connect(struct vfs_handle_struct *handle,
 				const char *service, const char *user)
 {
@@ -2192,6 +2207,8 @@ static int shadow_copy2_connect(struct vfs_handle_struct *handle,
 		return -1;
 	}
 
+	talloc_set_destructor(config, shadow_copy2_config_destructor);
+
 	gmt_format = lp_parm_const_string(SNUM(handle->conn),
 					  "shadow", "format",
 					  GMT_FORMAT);